US8799639B2 - Method and apparatus for converting authentication-tokens to facilitate interactions between applications - Google Patents
Method and apparatus for converting authentication-tokens to facilitate interactions between applicationsDownload PDFInfo
- Publication number
- US8799639B2 US8799639B2US11/493,693US49369306AUS8799639B2US 8799639 B2US8799639 B2US 8799639B2US 49369306 AUS49369306 AUS 49369306AUS 8799639 B2US8799639 B2US 8799639B2
- Authority
- US
- United States
- Prior art keywords
- authentication
- token
- application
- command
- execution request
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active, expires
Links
Images
Classifications
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/41—User authentication where a single sign-on provides access to a plurality of computers
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/33—User authentication using certificates
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
Definitions
- a tax-preparation applicationmay include the ability to perform operations which involve communicating with a financial application, but in order for a user who is already authenticated by the tax-preparation application to perform these operations, the user must first re-authenticate with the financial application.
- One embodiment of the present inventionprovides a system that converts authentication-tokens to facilitate interactions between applications.
- the systemreceives a command-execution request from a first application, wherein the command-execution request specifies a command to execute on a second application.
- the systemverifies a first authentication-token included with the command-execution request.
- the systemtranslates the first authentication-token into a form associated with the second application to produce a second authentication-token.
- the systemmodifies the command-execution request by replacing the first authentication-token with the second-authentication-token to create a modified command-execution request.
- the systemsends the modified command-execution request to the second application.
- the first applicationis located on the same computer system as the second application.
- the command-execution request from the first applicationcan include: a target Uniform Resource Locator (URL) which specifies the location of the second application; a first authentication-token type which specifies a form of the first authentication-token; a second authentication-token type which specifies a form of the second authentication-token; a user identifier for a user who is associated with the first authentication-token; payload data for the second application; and the command.
- a target Uniform Resource LocatorURL
- verifying the first authentication-tokeninvolves identifying a first authentication-token type for the first authentication-token. Next, the system uses decryption rules associated with the first authentication-token type to decrypt the first authentication-token to obtain a decrypted first authentication-token. Subsequently, the system verifies the validity of the decrypted first authentication-token.
- verifying the validity of the decrypted first authentication-tokencan involve verifying that the decrypted first authentication-token has not expired, and verifying that the decrypted first authentication-token is associated with a user identifier.
- translating the first authentication-tokeninvolves identifying a second authentication-token type which specifies a form of the second authentication-token for the second application.
- the systemidentifies a second user identifier which is mapped to a first user identifier, wherein the first user identifier is associated with the first authentication-token.
- the systemthen creates the second authentication-token, wherein the second authentication-token is associated with the second user identifier, wherein the second authentication-token is of the form specified by the second authentication-token type.
- creating the second authentication-tokeninvolves requesting the second authentication-token from a third-party authentication-token provider. Subsequently, the system receives the second authentication-token from the third-party authentication-token provider.
- the second user identifieris the same as the first user identifier.
- the first authentication-token and the second authentication-tokencan include a cookie, a digital certificate, a user-name/password pair, a cryptographic key, and a biometric identifier.
- modifying the command-execution requestinvolves modifying the command to have a format associated with the second application. Subsequently, the system includes the modified command with the modified command-execution request.
- FIG. 1illustrates a computing environment in accordance with an embodiment of the present invention.
- FIG. 2presents a flowchart illustrating the process of translating a command-execution request from a format associated with a first application to a format associated with a second application in accordance with an embodiment of the present invention.
- FIG. 3presents a flowchart illustrating the process of verifying an authentication-token in accordance with an embodiment of the present invention.
- FIG. 4presents a flowchart illustrating the process of translating a first authentication-token with a first authentication-token type to a second authentication-token type in accordance with an embodiment of the present invention.
- a computer-readable storage mediumwhich may be any device or medium that can store code and/or data for use by a computer system.
- One embodiment of the present inventionprovides a Single Sign-on Session Bridge, hereinafter referred to as a “bridge,” which solves the problem of bridging distinct domains associated with various security tokens.
- the bridgeaccomplishes this by securely translating a security token from one domain to another, and/or translating one type of security token to another type of security token.
- the applicationposts a session-token, or authentication-token, to the bridge.
- the bridgecan live in a virtual domain of the destination system, wherein the destination system hosts a second application, and wherein the link refers to the destination system.
- the bridgeis then able to translate the authentication-token into a form associated with the destination system.
- the bridgeauthenticates the user to the destination system, and subsequently, redirects the user to the destination system.
- FIG. 1illustrates a computing environment 100 in accordance with an embodiment of the present invention.
- Computing environment 100can generally include any type of computer system which can comprise a computer system based on a microprocessor, a mainframe computer, a digital signal processor, a portable computing device, a personal organizer, a device controller, and a computational engine within an appliance.
- computing environment 100can comprise client 110 , laptop 120 , network 130 , server 140 , server 150 , server 160 , application 145 , application 165 , and bridge 190 .
- Client 110 and laptop 120can generally include any node on a network including computational capability and including a mechanism for communicating across the network.
- Network 130can generally include any type of wired or wireless communication channel capable of coupling together computing nodes. This includes, but is not limited to, a local area network, a wide area network, or a combination of networks. In one embodiment of the present invention, network 130 comprises the Internet.
- Servers 140 , 150 , and 160can generally include any nodes on a computer network which comprises a mechanism for servicing requests from a client for computational and/or data storage resources.
- Applications 145 and 165can generally include any computer program.
- server 140executes application 145
- server 160executes application 165 .
- applications 145 and 165are instances of the same application.
- applications 145 and 165are instances of different applications.
- applications 145 and 165are components of the same application.
- Bridge 190can generally include any system that receives an authentication-token in a form associated with a first application 145 and translates the authentication-token to a form associated with a second application 165 .
- bridge 190can be an application hosted by client 110 , laptop 120 , or a server, such as server 140 .
- user 112accesses application 145 via client 110 .
- user 112authenticates to application 145 , which involves application 145 creating an authentication-token associated with user 112 .
- user 112clicks on a link that directs application 145 to send a command-execution request to bridge 190 that includes the authentication-token and a command for application 165 to execute.
- Bridge 190then converts the authentication-token into a form that application 165 can process.
- bridge 190sends a modified command-execution request to application 165 which includes the converted authentication-token as well as the command for application 165 to execute.
- bridge 190in response to receiving the authentication-token from application 145 , bridge 190 requests a second authentication-token from a third-party system, such as server 150 , wherein the second authentication-token is in a form associated with application 165 .
- server 150then sends the second authentication-token to bridge 190 , which subsequently, sends the second authentication-token to application 165 along with the command for application 165 to execute.
- administrator 122provides rules to bridge 190 via laptop 120 . These rules instruct bridge 190 on how to convert authentication-tokens into other types of authentication-tokens.
- bridge 190can present user 112 with a user-interface associated with bridge 190 , application 145 , or application 165 .
- this user-interfaceis non-interactive.
- the user-interfacecan provide user 112 with a status report for the command-execution request, or a splash screen associated with application 145 , application 165 , or bridge 190 .
- the user-interfaceis interactive.
- user 112can provide information to bridge 190 via the user-interface.
- Bridge 190can use the information to facilitate processing of the command-execution request.
- the command-execution requestincludes data that enables bridge 190 to customize the user-interface.
- bridge 190does not present a user-interface to user 112 .
- user 112may not be aware of the existence of bridge 190 .
- This embodimentallows an organization to provide a seamless experience to user 112 while using multiple applications.
- FIG. 2presents a flowchart illustrating the process of translating a command-execution request from a format associated with a first application to a format associated with a second application in accordance with an embodiment of the present invention.
- the command-execution requestincludes: a target Uniform Resource locator (URL), wherein the target URL specifies the location of application 165 ; a first authentication-token type which specifies a form of a first authentication-token, wherein the form of the first authentication-token is associated with application 145 ; a second authentication-token type which specifies a form of a second authentication-token, wherein the form of the second authentication-token is associated with application 165 ; a user identifier which is associated with the first authentication-token; payload data which allows application 165 to execute the command; and a command for application 165 to execute.
- URLUniform Resource locator
- the target URLspecifies the location of a web-page associated with application 165 .
- the target URLspecifies an entry point into application 165 .
- the command-execution requestcan specify the location of application 165 , or an entry point into application 165 using any protocol known to those familiar with the art.
- bridge 190verifies the validity of a first authentication-token, which is included with the command-execution request (step 204 ). Note that this is a multi-step process, which is described in more detail below with reference to FIG. 3 .
- the first authentication-tokencan include a cookie, a digital certificate, a user-name/password pair, a cryptographic key, a biometric identifier, and any other form of authentication-token known to those familiar with the art.
- bridge 190After verifying the validity of the first authentication-token, bridge 190 translates the first authentication-token to a form associated with application 165 to obtain a second authentication-token (step 206 ). Note that this is a multi-step process, which is described in more detail below with reference to FIG. 4 .
- the second authentication-tokencan include a cookie, a digital certificate, a user-name/password pair, a cryptographic key, a biometric identifier, and any other form of authentication-token known to those familiar with the art.
- server 140hosts both application 145 and application 165 .
- application 145 and application 165are two components of the same application.
- bridge 190modifies the command-execution request to create a modified command-execution request by replacing the first authentication-token with the second authentication-token (step 208 ).
- bridge 190modifies the command received from application 145 to create a modified command (step 210 ). To create this modified command, bridge 190 alters the format of the command to match a format associated with application 165 . This allows application 165 to execute the command. After creating the modified command, bridge 190 includes the modified command with the modified command-execution request (step 212 ). For example, in one embodiment of the present invention, application 145 formats a command in the following order: a command type, a variable, and then a value for the variable. However, application 165 formats the same command to specify the command type after the value for the variable.
- bridge 190re-formats the command from application 145 to match the command-format associated with application 165 .
- stepsare optional as illustrated by the dashed lines surrounding steps 210 and 212 .
- bridge 190sends the modified command-execution request to application 165 (step 214 ).
- FIG. 3presents a flowchart illustrating the process of verifying an authentication-token in accordance with an embodiment of the present invention.
- bridge 190attempting to identify a first authentication-token type for a first authentication-token included with a command-execution request (step 302 ).
- bridge 190attempts to identify the first authentication-token type by comparing the format of the first authentication-token to a set of known authentication-token formats.
- administrator 122specifies the set of known authentication-token formats to bridge 190 prior to bridge 190 receiving the command-execution request. This enables application 145 to communicate with applications that use different authentication-token types without modifying application 145 .
- the command-execution requestspecifies the first authentication-token type.
- bridge 190If bridge 190 is able to identify the first authentication-token type, then bridge 190 decrypts the first-authentication token using a decryption-rule associated with the first authentication-token type to obtain a decrypted first authentication-token (step 304 ).
- bridge 190decrypts the first authentication-token before identifying the first authentication-token type.
- bridge 190is capable of identifying the decryption-rule without identifying the first authentication-token type.
- application 145does not encrypt the first authentication-token, hence, bridge 190 does not have to decrypt the first authentication-token.
- bridge 190verifies the validity of the decrypted first authentication-token (step 306 ). Verifying the validity of the decrypted first authentication-token can involve: verifying that the decrypted first authentication-token has not expired; verifying that the decrypted first authentication-token is associated with a user identifier, wherein the user identifier is associated with user 112 ; verifying that the decrypted first authentication-token has not been tampered with; and any other token-verification process known to those familiar with the art.
- verifying that the decrypted first authentication-token has not been tampered withcan involve: verifying a hash value associated with the decrypted first authentication-token; verifying a digital certificate associated with the decrypted first authentication-token; verifying a cryptographic key associated with the decrypted first authentication-token; and any other process for identifying if the decrypted first authentication-token has been tampered with known to those familiar with the art.
- bridge 190determines that the decrypted first authentication-token is valid, then bridge 190 proceeds to step 206 . If bridge 190 is not able to identify the first authentication-token type, or if bridge 190 determines that the decrypted first authentication-token is not valid, then bridge 190 rejects the command-execution request (step 308 ). Bridge 190 then sends an error message to application 145 (step 310 ). At this point, the process ends, and bridge 190 does not continue to step 206 .
- sending the error messagecan include reporting that the authentication-token is expired, reporting that the authentication-token is invalid, reporting that bridge 190 cannot determine how to translate the authentication-token to a format associated with application 165 , reporting that bridge 190 is unavailable, and reporting any other error-message type known to those familiar with the art.
- bridge 190can request that user 112 re-authenticate with application 145 .
- application 145re-sends the command-execution request after user 112 re-authenticates with application 145 .
- bridge 190does not send an error message to application 145 .
- FIG. 4presents a flowchart illustrating the process of translating a first authentication-token associated with a first authentication-token type to a second authentication-token type in accordance with an embodiment of the present invention.
- bridge 190attempting to identify a second authentication-token type, wherein the second authentication-token type is associated with application 165 (step 402 ).
- bridge 190determines the second authentication-token type based on a target application, such as application 165 , of the command-execution request.
- administrator 122associates the second authentication-token type with application 165 prior to bridge 190 receiving the command-execution request.
- application 145includes the second authentication-token type with the command-execution request.
- bridge 190determines if there is a translation-rule associated with the first authentication-token type and the second authentication-token type (step 404 ).
- the translation-rulespecifies how to translate the first authentication-token into the format associated with the second-authentication token type to obtain the second authentication-token.
- administrator 122associates the translation-rule with the first authentication-token type and the second authentication-token type prior to bridge 190 receiving the command-execution request.
- bridge 190determines if there is a user-identifier mapping (step 406 ).
- the user-identifier mappingspecifies a second user identifier for a given combination of first user identifier, first authentication-token type, and second authentication-token type.
- Bridge 190includes the second user identifier with the modified command-execution request that bridge 190 sends to application 165 .
- the first user identifier and the second user identifierare the same user identifiers.
- bridge 190uses the translation-rule to create a second authentication-token of the second authentication-token type (step 408 ). Bridge 190 then proceeds to execute step 208 .
- bridge 190uses a combination of the translation-rule and the user-identifier mapping to facilitate in creating the second authentication-token.
- bridge 190creates the second authentication-token by requesting the second authentication-token from a third-party, such as server 150 , associated with the second authentication-token type. For example, if the second authentication-token type indicates that application 165 requires a digital certificate to authenticate user 112 , and that server 150 is a certificate authority, then bridge 190 can contact server 150 to obtain the digital certificate. Server 150 can then send the second authentication-token to bridge 190 .
- a third-partysuch as server 150
- bridge 190If bridge 190 cannot identify the second authentication-token type, a translation-rule, or a user-identifier mapping, then bridge 190 rejects the command-execution request (step 410 ). Bridge 190 then sends an error message to application 145 (step 412 ). At this point, the process ends, and bridge 190 does not continue to step 208 .
- sending the error messagecan include reporting that the authentication-token is expired, that the authentication-token is invalid, that bridge 190 cannot determine how to translate the authentication-token to a format associated with application 165 , that bridge 190 is unavailable, and any other error-message type known to those familiar with the art.
- bridge 190can contact user 112 to request identification of the first authentication-token type, second authentication-token type, a translation-rule, or a user-identifier mapping.
- bridge 190can store user 112 's response to this request.
- bridge 190will be able to complete the request without user 112 's assistance.
- this embodimentcan enable user 112 to program bridge 190 to perform authentication-token translations that are in addition to those programmed by administrator 122 .
- bridge 190can contact administrator 122 to request identification of the first authentication-token type, second authentication-token type, a translation-rule, or a user-identifier mapping.
- administrator 122does not need to specify the set of known authentication-token formats, associate the authentication-token formats with the applicable applications, specify a translation-rule, or specify a user-identifier mapping prior to bridge 190 receiving the command-execution request.
- bridge 190does not send an error message to application 145 .
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Software Systems (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Storage Device Security (AREA)
- Information Transfer Between Computers (AREA)
Abstract
Description
Many applications perform operations which involve contacting another application. Often, each of these applications has its own distinct user-authentication procedure. Thus, when a user activates a feature in a first application, and the feature communicates with a second application, the second application often requires the user to re-authenticate. For example, a tax-preparation application may include the ability to perform operations which involve communicating with a financial application, but in order for a user who is already authenticated by the tax-preparation application to perform these operations, the user must first re-authenticate with the financial application.
Hence, each time an application communicates with another application, the user may have to re-authenticate. This need to re-authenticate prevents an organization from providing a seamless user experience, and can be time-consuming and inconvenient for a busy user.
One embodiment of the present invention provides a system that converts authentication-tokens to facilitate interactions between applications. During operation, the system receives a command-execution request from a first application, wherein the command-execution request specifies a command to execute on a second application. Subsequently, the system verifies a first authentication-token included with the command-execution request. Next, the system translates the first authentication-token into a form associated with the second application to produce a second authentication-token. The system then modifies the command-execution request by replacing the first authentication-token with the second-authentication-token to create a modified command-execution request. Then, the system sends the modified command-execution request to the second application.
In a variation on this embodiment, the first application is located on the same computer system as the second application.
In a variation on this embodiment, the command-execution request from the first application can include: a target Uniform Resource Locator (URL) which specifies the location of the second application; a first authentication-token type which specifies a form of the first authentication-token; a second authentication-token type which specifies a form of the second authentication-token; a user identifier for a user who is associated with the first authentication-token; payload data for the second application; and the command.
In a variation on this embodiment, verifying the first authentication-token involves identifying a first authentication-token type for the first authentication-token. Next, the system uses decryption rules associated with the first authentication-token type to decrypt the first authentication-token to obtain a decrypted first authentication-token. Subsequently, the system verifies the validity of the decrypted first authentication-token.
In a further variation, verifying the validity of the decrypted first authentication-token can involve verifying that the decrypted first authentication-token has not expired, and verifying that the decrypted first authentication-token is associated with a user identifier.
In a variation on this embodiment, translating the first authentication-token involves identifying a second authentication-token type which specifies a form of the second authentication-token for the second application. Next, the system identifies a second user identifier which is mapped to a first user identifier, wherein the first user identifier is associated with the first authentication-token. The system then creates the second authentication-token, wherein the second authentication-token is associated with the second user identifier, wherein the second authentication-token is of the form specified by the second authentication-token type.
In a further variation, creating the second authentication-token involves requesting the second authentication-token from a third-party authentication-token provider. Subsequently, the system receives the second authentication-token from the third-party authentication-token provider.
In a further variation, the second user identifier is the same as the first user identifier.
In a variation on this embodiment, the first authentication-token and the second authentication-token can include a cookie, a digital certificate, a user-name/password pair, a cryptographic key, and a biometric identifier.
In a variation on this embodiment, modifying the command-execution request involves modifying the command to have a format associated with the second application. Subsequently, the system includes the modified command with the modified command-execution request.
The following description is presented to enable any person skilled in the art to make and use the invention, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present invention. Thus, the present invention is not limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.
The data structures and code described in this detailed description are typically stored on a computer-readable storage medium, which may be any device or medium that can store code and/or data for use by a computer system. This includes, but is not limited to, volatile memory, non-volatile memory, magnetic and optical storage devices such as disk drives, magnetic tape, CDs (compact discs), DVDs (digital versatile discs or digital video discs), or other media capable of storing computer readable media now known or later developed.
Overview
One embodiment of the present invention provides a Single Sign-on Session Bridge, hereinafter referred to as a “bridge,” which solves the problem of bridging distinct domains associated with various security tokens. The bridge accomplishes this by securely translating a security token from one domain to another, and/or translating one type of security token to another type of security token.
For example, in one embodiment of the present invention, when a user clicks a link associated with an application, the application posts a session-token, or authentication-token, to the bridge. In this embodiment, the bridge can live in a virtual domain of the destination system, wherein the destination system hosts a second application, and wherein the link refers to the destination system. The bridge is then able to translate the authentication-token into a form associated with the destination system. Using the translated authentication-token, the bridge authenticates the user to the destination system, and subsequently, redirects the user to the destination system.
Computer System
Network130 can generally include any type of wired or wireless communication channel capable of coupling together computing nodes. This includes, but is not limited to, a local area network, a wide area network, or a combination of networks. In one embodiment of the present invention,network 130 comprises the Internet.
In one embodiment of the present application,applications
In one embodiment of the present application,applications
In one embodiment of the present application,applications
In one embodiment of the present invention, user112 accessesapplication 145 viaclient 110. Before user112 can begin usingapplication 145, user112 authenticates toapplication 145, which involvesapplication 145 creating an authentication-token associated with user112. While usingapplication 145, user112 clicks on a link that directsapplication 145 to send a command-execution request to bridge190 that includes the authentication-token and a command forapplication 165 to execute.Bridge 190 then converts the authentication-token into a form thatapplication 165 can process. Next,bridge 190 sends a modified command-execution request toapplication 165 which includes the converted authentication-token as well as the command forapplication 165 to execute.
In one embodiment of the present invention, in response to receiving the authentication-token fromapplication 145, bridge190 requests a second authentication-token from a third-party system, such asserver 150, wherein the second authentication-token is in a form associated withapplication 165.Server 150 then sends the second authentication-token to bridge190, which subsequently, sends the second authentication-token toapplication 165 along with the command forapplication 165 to execute.
In one embodiment of the present invention,administrator 122 provides rules to bridge190 vialaptop 120. These rules instructbridge 190 on how to convert authentication-tokens into other types of authentication-tokens.
In one embodiment of the present invention,bridge 190 can present user112 with a user-interface associated withbridge 190,application 145, orapplication 165. In one embodiment of the present invention, this user-interface is non-interactive. In this embodiment, the user-interface can provide user112 with a status report for the command-execution request, or a splash screen associated withapplication 145,application 165, orbridge 190.
In one embodiment of the present invention, the user-interface is interactive. In this embodiment, user112 can provide information to bridge190 via the user-interface. Bridge190 can use the information to facilitate processing of the command-execution request.
In one embodiment of the present invention, the command-execution request includes data that enablesbridge 190 to customize the user-interface.
In one embodiment of the present invention,bridge 190 does not present a user-interface to user112. In this embodiment, user112 may not be aware of the existence ofbridge 190. This embodiment allows an organization to provide a seamless experience to user112 while using multiple applications.
Translating a Command-Execution Request
The process begins whenbridge 190 receives a command-execution request fromapplication 145, whichserver 140 hosts (step202). In one embodiment of the present invention, the command-execution request includes: a target Uniform Resource locator (URL), wherein the target URL specifies the location ofapplication 165; a first authentication-token type which specifies a form of a first authentication-token, wherein the form of the first authentication-token is associated withapplication 145; a second authentication-token type which specifies a form of a second authentication-token, wherein the form of the second authentication-token is associated withapplication 165; a user identifier which is associated with the first authentication-token; payload data which allowsapplication 165 to execute the command; and a command forapplication 165 to execute.
In one embodiment of the present invention, the target URL specifies the location of a web-page associated withapplication 165.
In one embodiment of the present invention, the target URL specifies an entry point intoapplication 165.
In one embodiment of the present invention, the command-execution request can specify the location ofapplication 165, or an entry point intoapplication 165 using any protocol known to those familiar with the art.
Next,bridge 190 verifies the validity of a first authentication-token, which is included with the command-execution request (step204). Note that this is a multi-step process, which is described in more detail below with reference toFIG. 3 .
In one embodiment of the present invention, the first authentication-token can include a cookie, a digital certificate, a user-name/password pair, a cryptographic key, a biometric identifier, and any other form of authentication-token known to those familiar with the art.
After verifying the validity of the first authentication-token,bridge 190 translates the first authentication-token to a form associated withapplication 165 to obtain a second authentication-token (step206). Note that this is a multi-step process, which is described in more detail below with reference toFIG. 4 .
In one embodiment of the present invention, the second authentication-token can include a cookie, a digital certificate, a user-name/password pair, a cryptographic key, a biometric identifier, and any other form of authentication-token known to those familiar with the art.
In one embodiment of the present invention,server 140 hosts bothapplication 145 andapplication 165.
In one embodiment of the present invention,application 145 andapplication 165 are two components of the same application.
Next,bridge 190 modifies the command-execution request to create a modified command-execution request by replacing the first authentication-token with the second authentication-token (step208).
In one embodiment of the present invention,bridge 190 modifies the command received fromapplication 145 to create a modified command (step210). To create this modified command,bridge 190 alters the format of the command to match a format associated withapplication 165. This allowsapplication 165 to execute the command. After creating the modified command,bridge 190 includes the modified command with the modified command-execution request (step212). For example, in one embodiment of the present invention,application 145 formats a command in the following order: a command type, a variable, and then a value for the variable. However,application 165 formats the same command to specify the command type after the value for the variable. Thus, forapplication 165 to execute a command issued byapplication 145,bridge 190 re-formats the command fromapplication 145 to match the command-format associated withapplication 165. These steps are optional as illustrated by the dashedlines surrounding steps
Oncebridge 190 has finished creating the modified command-execution request,bridge 190 sends the modified command-execution request to application165 (step214).
Verifying an Authentication-Token
The process begins withbridge 190 attempting to identify a first authentication-token type for a first authentication-token included with a command-execution request (step302). In one embodiment of the present invention, bridge190 attempts to identify the first authentication-token type by comparing the format of the first authentication-token to a set of known authentication-token formats. In this embodiment,administrator 122 specifies the set of known authentication-token formats to bridge190 prior to bridge190 receiving the command-execution request. This enablesapplication 145 to communicate with applications that use different authentication-token types without modifyingapplication 145.
In one embodiment of the present invention, the command-execution request specifies the first authentication-token type.
Ifbridge 190 is able to identify the first authentication-token type, then bridge190 decrypts the first-authentication token using a decryption-rule associated with the first authentication-token type to obtain a decrypted first authentication-token (step304).
In one embodiment of the present invention,bridge 190 decrypts the first authentication-token before identifying the first authentication-token type. In this embodiment,bridge 190 is capable of identifying the decryption-rule without identifying the first authentication-token type.
In one embodiment of the present invention,application 145 does not encrypt the first authentication-token, hence,bridge 190 does not have to decrypt the first authentication-token.
After decrypting the first authentication-token,bridge 190 verifies the validity of the decrypted first authentication-token (step306). Verifying the validity of the decrypted first authentication-token can involve: verifying that the decrypted first authentication-token has not expired; verifying that the decrypted first authentication-token is associated with a user identifier, wherein the user identifier is associated with user112; verifying that the decrypted first authentication-token has not been tampered with; and any other token-verification process known to those familiar with the art.
In one embodiment of the present invention, verifying that the decrypted first authentication-token has not been tampered with can involve: verifying a hash value associated with the decrypted first authentication-token; verifying a digital certificate associated with the decrypted first authentication-token; verifying a cryptographic key associated with the decrypted first authentication-token; and any other process for identifying if the decrypted first authentication-token has been tampered with known to those familiar with the art.
Ifbridge 190 determines that the decrypted first authentication-token is valid, then bridge190 proceeds to step206. Ifbridge 190 is not able to identify the first authentication-token type, or ifbridge 190 determines that the decrypted first authentication-token is not valid, then bridge190 rejects the command-execution request (step308).Bridge 190 then sends an error message to application145 (step310). At this point, the process ends, andbridge 190 does not continue to step206.
In one embodiment of the present invention, sending the error message can include reporting that the authentication-token is expired, reporting that the authentication-token is invalid, reporting thatbridge 190 cannot determine how to translate the authentication-token to a format associated withapplication 165, reporting thatbridge 190 is unavailable, and reporting any other error-message type known to those familiar with the art.
In one embodiment of the present invention,bridge 190 can request that user112 re-authenticate withapplication 145. In this embodiment,application 145 re-sends the command-execution request after user112 re-authenticates withapplication 145.
In one embodiment of the present invention,bridge 190 does not send an error message toapplication 145.
Translating an Authentication-Token
The process begins withbridge 190 attempting to identify a second authentication-token type, wherein the second authentication-token type is associated with application165 (step402). In one embodiment of the present invention,bridge 190 determines the second authentication-token type based on a target application, such asapplication 165, of the command-execution request. In this embodiment,administrator 122 associates the second authentication-token type withapplication 165 prior to bridge190 receiving the command-execution request.
In one embodiment of the present invention,application 145 includes the second authentication-token type with the command-execution request.
Ifbridge 190 is successful in identifying the second authentication-token type, then bridge190 determines if there is a translation-rule associated with the first authentication-token type and the second authentication-token type (step404). Note that the translation-rule specifies how to translate the first authentication-token into the format associated with the second-authentication token type to obtain the second authentication-token. In one embodiment of the present invention,administrator 122 associates the translation-rule with the first authentication-token type and the second authentication-token type prior to bridge190 receiving the command-execution request.
Ifbridge 190 is successful in identifying a translation-rule associated with the second authentication-token type, then bridge190 determines if there is a user-identifier mapping (step406). Note that the user-identifier mapping specifies a second user identifier for a given combination of first user identifier, first authentication-token type, and second authentication-token type.Bridge 190 includes the second user identifier with the modified command-execution request thatbridge 190 sends toapplication 165.
In one embodiment of the present invention, the first user identifier and the second user identifier are the same user identifiers.
Ifbridge 190 is successful in identifying a user-identifier mapping, then bridge190 uses the translation-rule to create a second authentication-token of the second authentication-token type (step408).Bridge 190 then proceeds to executestep 208.
In one embodiment of the present invention,bridge 190 uses a combination of the translation-rule and the user-identifier mapping to facilitate in creating the second authentication-token.
In one embodiment of the present invention,bridge 190 creates the second authentication-token by requesting the second authentication-token from a third-party, such asserver 150, associated with the second authentication-token type. For example, if the second authentication-token type indicates thatapplication 165 requires a digital certificate to authenticate user112, and thatserver 150 is a certificate authority, then bridge190 can contactserver 150 to obtain the digital certificate.Server 150 can then send the second authentication-token to bridge190.
Ifbridge 190 cannot identify the second authentication-token type, a translation-rule, or a user-identifier mapping, then bridge190 rejects the command-execution request (step410).Bridge 190 then sends an error message to application145 (step412). At this point, the process ends, andbridge 190 does not continue to step208.
In one embodiment of the present invention, sending the error message can include reporting that the authentication-token is expired, that the authentication-token is invalid, thatbridge 190 cannot determine how to translate the authentication-token to a format associated withapplication 165, thatbridge 190 is unavailable, and any other error-message type known to those familiar with the art.
In one embodiment of the present invention,bridge 190 can contact user112 to request identification of the first authentication-token type, second authentication-token type, a translation-rule, or a user-identifier mapping. In this embodiment,bridge 190 can store user112's response to this request. Thus, ifbridge 190 receives a second command-execution request from user112,bridge 190 will be able to complete the request without user112's assistance. Note that this embodiment can enable user112 toprogram bridge 190 to perform authentication-token translations that are in addition to those programmed byadministrator 122.
In one embodiment of the present invention,bridge 190 can contactadministrator 122 to request identification of the first authentication-token type, second authentication-token type, a translation-rule, or a user-identifier mapping. In this embodiment,administrator 122 does not need to specify the set of known authentication-token formats, associate the authentication-token formats with the applicable applications, specify a translation-rule, or specify a user-identifier mapping prior to bridge190 receiving the command-execution request.
In one embodiment of the present invention,bridge 190 does not send an error message toapplication 145.
The foregoing descriptions of embodiments of the present invention have been presented only for purposes of illustration and description. They are not intended to be exhaustive or to limit the present invention to the forms disclosed. Accordingly, many modifications and variations will be apparent to practitioners skilled in the art. Additionally, the above disclosure is not intended to limit the present invention. The scope of the present invention is defined by the appended claims.
Claims (26)
1. A computer-implemented method for converting authentication-tokens, comprising:
receiving, at a computer, a command-execution request from a first application, wherein the command-execution request specifies a command to be executed by a second application and includes a first authentication-token that is created by the first application based on a user authenticating to the first application;
verifying the first authentication-token at the computer;
translating the first authentication-token to a form associated with the second application to produce a second authentication-token, wherein the second authentication-token is in a form different than the first authentication-token;
modifying the command-execution request by replacing the first authentication-token with the second authentication-token to create a modified command-execution request; and
sending the modified command-execution request to the second application,
wherein the command-execution request includes a target Uniform Resource Locator (URL) which specifies a location of the second application, a second authentication-token type which specifies a form of the second authentication-token, a user identifier for a user who is associated with the first authentication-token, and payload data for the second application.
2. The method ofclaim 1 , wherein the first application is located on the same computer system as the second application.
3. The method ofclaim 1 , wherein the command-execution request comprises a first authentication-token type which specifies a form of the first authentication-token.
4. The method ofclaim 1 , wherein verifying the first authentication-token further comprises:
identifying a first authentication-token type for the first authentication-token;
using decryption rules associated with the first authentication-token type to decrypt the first authentication-token to produce a decrypted first authentication-token; and
verifying the validity of the decrypted first authentication-token.
5. The method ofclaim 4 , wherein verifying the validity of the decrypted first authentication-token can involve:
verifying that the decrypted first authentication-token has not expired; and
verifying that the decrypted first authentication-token is associated with a user identifier.
6. The method ofclaim 1 , wherein translating the first authentication-token further comprises:
identifying the second authentication-token type;
identifying a second user identifier which is mapped from the user identifier; and
creating the second authentication-token associated with the second user identifier, wherein the second authentication-token is of the form specified by the second-authentication-token type.
7. The method ofclaim 6 , wherein creating the second authentication-token can involve:
requesting the second authentication-token from a third-party authentication-token provider; and
receiving the second authentication-token from the third-party authentication-token provider.
8. The method ofclaim 6 , wherein the second user identifier comprises the user identifier.
9. The method ofclaim 1 , wherein the first authentication-token and the second authentication-token include one or more of:
a cookie;
a digital certificate;
a user-name/password pair;
a cryptographic key; and
a biometric identifier.
10. The method ofclaim 1 , wherein modifying the command-execution request further comprises:
modifying a format of the command to a format associated with the second application; and
including the modified command with the modified command-execution request.
11. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for converting authentication-tokens, the method comprising:
receiving, at a bridge, a command-execution request from a first application, wherein the command-execution request specifies a command to be executed by a second application and includes a first authentication-token that is created by the first application based on a user authenticating to the first application;
verifying the first authentication-token at the bridge;
translating the first authentication-token to a form associated with the second application to produce a second authentication-token, wherein the second authentication-token is in a form different than the first authentication-token;
modifying the command-execution request by replacing the first authentication-token with the second authentication-token to create a modified command-execution request; and
sending the modified command-execution request to the second application,
wherein the command-execution request includes a target Uniform Resource Locator (URL) which specifies a location of the second application, a second authentication-token type which specifies a form of the second authentication-token, a user identifier for a user who is associated with the first authentication-token, and payload data for the second application.
12. The computer-readable storage medium ofclaim 11 , wherein the first application is located on the same computer system as the second application.
13. The computer-readable storage medium ofclaim 11 , wherein the command-execution request comprises a first authentication-token type which specifies a form of the first authentication-token.
14. The computer-readable storage medium ofclaim 11 , wherein verifying the first authentication-token further comprises:
identifying a first authentication-token type for the first authentication-token;
using decryption rules associated with the first authentication-token type to decrypt the first authentication-token to produce authentication-token; and
verifying the validity of the decrypted first authentication-token.
15. The computer-readable storage medium ofclaim 14 , wherein verifying the validity of the decrypted first authentication-token can involve:
verifying that the decrypted first authentication-token has not expired; and
verifying that the decrypted first authentication-token is associated with a user identifier.
16. The computer-readable storage medium ofclaim 11 , wherein translating the first authentication-token further comprises:
identifying the second authentication-token type;
identifying a second user identifier which is mapped from and the user identifier; and
creating the second authentication-token associated with the second user identifier, wherein the second authentication-token is of the form specified by the second-authentication-token type.
17. The computer-readable storage medium ofclaim 16 , wherein creating the second authentication-token can involve:
requesting the second authentication-token from a third-party authentication-token provider; and
receiving the second authentication-token from the third-party authentication-token provider.
18. The computer-readable storage medium ofclaim 16 , wherein the second user identifier comprises the user identifier.
19. The computer-readable storage medium ofclaim 11 , wherein the first authentication-token and the second authentication-token include one or more of:
a cookie;
a digital certificate;
a user-name/password pair;
a cryptographic key; and
a biometric identifier.
20. The computer-readable storage medium ofclaim 11 , wherein modifying the command-execution request further comprises:
modifying a format of the command to a format associated with the second application; and
including the modified command with the modified command-execution request.
21. An apparatus that converts authentication-tokens, comprising:
a receiving mechanism configured to receive, at a bridge, a command-execution request from a first application, wherein the command-execution request specifies a command to be executed by a second application and includes a first authentication-token that is created by the first application based on a user authenticating to the first application;
a verification mechanism configured to verify the first authentication token at the bridge;
a translation mechanism configured to translate the first authentication-token to a form associated with the second application to produce a second authentication-token, wherein the second authentication-token is in a form different than the first authentication-token;
a modification mechanism configured to modify the command-execution request by replacing the first authentication-token with the second authentication-token to create a modified command-execution request; and
a sending mechanism configured to send the modified command-execution request to the second application,
wherein the command-execution request includes a target Uniform Resource Locator (URL) which specifies a location of the second application, a second authentication-token type which specifies a form of the second authentication-token, a user identifier for a user who is associated with the first authentication-token, and payload data for the second application.
22. The apparatus ofclaim 21 , wherein the verification mechanism further comprises:
an identification mechanism configured to identify a first authentication-token type for the first authentication-token;
a decryption mechanism configured to use decryption rules associated with the first authentication-token type to decrypt the first authentication-token to produce a decrypted first authentication-token; and
a second verification mechanism configured to verify the validity of the decrypted first authentication-token.
23. The apparatus ofclaim 21 , wherein the translation mechanism further comprises:
an identification mechanism configured to identify the second authentication-token type;
a second identification mechanism configured to identify a second user identifier which is mapped from and the user identifier; and
a creation mechanism configured to create the second authentication-token associated with the second user identifier, wherein the second authentication-token is of the form specified by the second-authentication-token type.
24. The apparatus ofclaim 22 , wherein the second verification mechanism is further configured to:
verify that the decrypted first authentication-token has not expired; and to
verify that the decrypted first authentication-token is associated with a user identifier.
25. The apparatus ofclaim 23 , wherein the creation mechanism further comprises:
a requesting mechanism configured to request the second authentication-token from a third-party authentication-token provider; and
a receiving mechanism configured to receive the second authentication-token from the third-party authentication-token provider.
26. The apparatus ofclaim 21 , wherein the modification mechanism is further configured to:
modify a format of the command to a format associated with the second application; and to
include the modified command with the modified command-execution request.
Priority Applications (5)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US11/493,693US8799639B2 (en) | 2006-07-25 | 2006-07-25 | Method and apparatus for converting authentication-tokens to facilitate interactions between applications |
| AU2007203101AAU2007203101B8 (en) | 2006-07-25 | 2007-07-03 | Method and apparatus for converting authentication-tokens to facilitate interactions between applications |
| GB0713184.0AGB2440425B (en) | 2006-07-25 | 2007-07-06 | Method and apparatus for converting authentication-tokens |
| DE102007033615.4ADE102007033615B4 (en) | 2006-07-25 | 2007-07-17 | Method and apparatus for converting authentication tokens to enable interactions between applications |
| CN2007101390245ACN101114237B (en) | 2006-07-25 | 2007-07-23 | Method and apparatus for converting authentication-tokens to facilitate interactions between applications |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US11/493,693US8799639B2 (en) | 2006-07-25 | 2006-07-25 | Method and apparatus for converting authentication-tokens to facilitate interactions between applications |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| US20080046715A1 US20080046715A1 (en) | 2008-02-21 |
| US8799639B2true US8799639B2 (en) | 2014-08-05 |
Family
ID=38440550
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| US11/493,693Active2030-07-31US8799639B2 (en) | 2006-07-25 | 2006-07-25 | Method and apparatus for converting authentication-tokens to facilitate interactions between applications |
Country Status (5)
| Country | Link |
|---|---|
| US (1) | US8799639B2 (en) |
| CN (1) | CN101114237B (en) |
| AU (1) | AU2007203101B8 (en) |
| DE (1) | DE102007033615B4 (en) |
| GB (1) | GB2440425B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120167186A1 (en)* | 2009-07-14 | 2012-06-28 | Bundesdruckerei Gmbh | Method for producing a soft token |
| US20130318569A1 (en)* | 2012-05-22 | 2013-11-28 | International Business Machines Corporation | Propagating Delegated Authorized Credentials Through Legacy Systems |
| US20220337576A1 (en)* | 2021-04-15 | 2022-10-20 | Jpmorgan Chase Bank, N.A. | System and method for smart authentication |
Families Citing this family (54)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2005086802A2 (en) | 2004-03-08 | 2005-09-22 | Proxense, Llc | Linked account system using personal digital key (pdk-las) |
| EP1829283A2 (en) | 2004-12-20 | 2007-09-05 | Proxense, LLC | Biometric personal data key (pdk) authentication |
| US8219129B2 (en) | 2006-01-06 | 2012-07-10 | Proxense, Llc | Dynamic real-time tiered client access |
| US11206664B2 (en) | 2006-01-06 | 2021-12-21 | Proxense, Llc | Wireless network synchronization of cells and client devices on a network |
| US7904718B2 (en) | 2006-05-05 | 2011-03-08 | Proxense, Llc | Personal digital key differentiation for secure transactions |
| US9269221B2 (en) | 2006-11-13 | 2016-02-23 | John J. Gobbi | Configuration of interfaces for a location detection system and application |
| US8073558B2 (en) | 2007-10-05 | 2011-12-06 | Honeywell International Inc | Critical resource notification system and interface device |
| US8659427B2 (en) | 2007-11-09 | 2014-02-25 | Proxense, Llc | Proximity-sensor supporting multiple application services |
| US8171528B1 (en) | 2007-12-06 | 2012-05-01 | Proxense, Llc | Hybrid device having a personal digital key and receiver-decoder circuit and methods of use |
| US9251332B2 (en)* | 2007-12-19 | 2016-02-02 | Proxense, Llc | Security system and method for controlling access to computing resources |
| WO2009102979A2 (en) | 2008-02-14 | 2009-08-20 | Proxense, Llc | Proximity-based healthcare management system with automatic access to private information |
| WO2009126732A2 (en) | 2008-04-08 | 2009-10-15 | Proxense, Llc | Automated service-based order processing |
| US20100185871A1 (en)* | 2009-01-15 | 2010-07-22 | Authentiverse, Inc. | System and method to provide secure access to personal information |
| US9124535B2 (en) | 2009-07-17 | 2015-09-01 | Honeywell International Inc. | System for using attributes to deploy demand response resources |
| US9137050B2 (en) | 2009-07-17 | 2015-09-15 | Honeywell International Inc. | Demand response system incorporating a graphical processing unit |
| US8782190B2 (en)* | 2009-07-17 | 2014-07-15 | Honeywell International, Inc. | Demand response management system |
| US8671167B2 (en)* | 2009-07-17 | 2014-03-11 | Honeywell International Inc. | System for providing demand response services |
| US8671191B2 (en) | 2009-07-17 | 2014-03-11 | Honeywell International Inc. | Installation system for demand response resources |
| US8676953B2 (en) | 2009-07-17 | 2014-03-18 | Honeywell International Inc. | Use of aggregated groups for managing demand response resources |
| US8572230B2 (en) | 2009-07-17 | 2013-10-29 | Honeywell International Inc. | System for using attributes to deploy demand response resources |
| US8667132B2 (en) | 2009-07-17 | 2014-03-04 | Honeywell International Inc. | Arrangement for communication about and management of a resource using a mobile device |
| US9818073B2 (en) | 2009-07-17 | 2017-11-14 | Honeywell International Inc. | Demand response management system |
| EP2334034B1 (en)* | 2009-11-11 | 2018-06-27 | BlackBerry Limited | Using a trusted token and push for validating the request for single sign on |
| US8522335B2 (en)* | 2009-12-01 | 2013-08-27 | International Business Machines Corporation | Token mediation service in a data management system |
| US20110202989A1 (en)* | 2010-02-18 | 2011-08-18 | Nokia Corporation | Method and apparatus for providing authentication session sharing |
| US9418205B2 (en) | 2010-03-15 | 2016-08-16 | Proxense, Llc | Proximity-based system for automatic application or data access and item tracking |
| US20130144942A1 (en)* | 2010-03-19 | 2013-06-06 | Gopi Krishnan Nambiar | Session persistence for accessing textsites |
| US8918854B1 (en) | 2010-07-15 | 2014-12-23 | Proxense, Llc | Proximity-based system for automatic application initialization |
| US8626354B2 (en) | 2011-01-28 | 2014-01-07 | Honeywell International Inc. | Approach for normalizing automated demand response events in energy management control systems |
| US8630744B2 (en) | 2011-01-28 | 2014-01-14 | Honeywell International Inc. | Management and monitoring of automated demand response in a multi-site enterprise |
| US9153001B2 (en) | 2011-01-28 | 2015-10-06 | Honeywell International Inc. | Approach for managing distribution of automated demand response events in a multi-site enterprise |
| US8857716B1 (en) | 2011-02-21 | 2014-10-14 | Proxense, Llc | Implementation of a proximity-based system for object tracking and automatic application initialization |
| US20140081704A1 (en) | 2012-09-15 | 2014-03-20 | Honeywell International Inc. | Decision support system based on energy markets |
| US9389850B2 (en) | 2012-11-29 | 2016-07-12 | Honeywell International Inc. | System and approach to manage versioning of field devices in a multi-site enterprise |
| US9286323B2 (en)* | 2013-02-25 | 2016-03-15 | International Business Machines Corporation | Context-aware tagging for augmented reality environments |
| WO2014183106A2 (en) | 2013-05-10 | 2014-11-13 | Proxense, Llc | Secure element as a digital pocket |
| US9691076B2 (en) | 2013-07-11 | 2017-06-27 | Honeywell International Inc. | Demand response system having a participation predictor |
| US10346931B2 (en) | 2013-07-11 | 2019-07-09 | Honeywell International Inc. | Arrangement for communicating demand response resource incentives |
| US9989937B2 (en) | 2013-07-11 | 2018-06-05 | Honeywell International Inc. | Predicting responses of resources to demand response signals and having comfortable demand responses |
| GB2523331A (en) | 2014-02-20 | 2015-08-26 | Ibm | Attribute-based access control |
| US9665078B2 (en) | 2014-03-25 | 2017-05-30 | Honeywell International Inc. | System for propagating messages for purposes of demand response |
| CN104580490B (en)* | 2015-01-20 | 2018-09-18 | 无线生活（杭州）信息科技有限公司 | Order transmission method and device |
| CN106156648B (en) | 2015-04-13 | 2020-09-04 | 腾讯科技（深圳）有限公司 | Sensitive operation processing method and device |
| US9594922B1 (en)* | 2015-06-30 | 2017-03-14 | EMC IP Holding Company LLC | Non-persistent shared authentication tokens in a cluster of nodes |
| US10162958B2 (en)* | 2016-03-15 | 2018-12-25 | Ricoh Company, Ltd. | Information processing system, information processing method, and non-transitory computer program product |
| WO2018039233A1 (en)* | 2016-08-22 | 2018-03-01 | Akamai Technologies, Inc. | Providing single sign-on (sso) in disjoint networks with non-overlapping authentication protocols |
| US10261767B2 (en)* | 2016-09-15 | 2019-04-16 | Talend, Inc. | Data integration job conversion |
| US10541556B2 (en) | 2017-04-27 | 2020-01-21 | Honeywell International Inc. | System and approach to integrate and manage diverse demand response specifications for multi-site enterprises |
| US10915897B2 (en) | 2018-06-13 | 2021-02-09 | Clover Network, Inc. | Token management for enhanced omni-channel payments experience and analytics |
| FR3111203B1 (en)* | 2020-06-08 | 2023-02-10 | Evidian | Computer device and method for authenticating a user |
| CN112199656B (en)* | 2020-12-03 | 2021-02-26 | 湖北亿咖通科技有限公司 | Access authority acquisition method of service platform and access control method of service platform |
| CN112199659B (en)* | 2020-12-03 | 2021-03-23 | 湖北亿咖通科技有限公司 | Access method, system and electronic device for multi-service platform of vehicle |
| US20230136230A1 (en)* | 2021-11-01 | 2023-05-04 | Walmart Apollo, Llc | Access token conversion |
| DE102023004043A1 (en) | 2023-10-07 | 2025-04-10 | Mercedes-Benz Group AG | Computer-implemented authorization management procedure and information technology system |
Citations (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20010000358A1 (en) | 1998-06-12 | 2001-04-19 | Kousei Isomichi | Gateway system and recording medium |
| WO2001052025A2 (en) | 2000-01-10 | 2001-07-19 | Sun Microsystems, Inc. | Accessing multiple services with a unique user name |
| WO2002039237A2 (en) | 2000-11-09 | 2002-05-16 | International Business Machines Corporation | Method and system for web-based cross-domain single-sign-on authentication |
| US20020156905A1 (en) | 2001-02-21 | 2002-10-24 | Boris Weissman | System for logging on to servers through a portal computer |
| US20030177388A1 (en)* | 2002-03-15 | 2003-09-18 | International Business Machines Corporation | Authenticated identity translation within a multiple computing unit environment |
| US20060041933A1 (en) | 2004-08-23 | 2006-02-23 | International Business Machines Corporation | Single sign-on (SSO) for non-SSO-compliant applications |
| US20060179312A1 (en)* | 2003-12-23 | 2006-08-10 | Wachovia Corporation | Authentication system for networked computer applications |
| US20070255958A1 (en)* | 2006-05-01 | 2007-11-01 | Microsoft Corporation | Claim transformations for trust relationships |
| US20070271618A1 (en)* | 2006-05-19 | 2007-11-22 | Ching-Yun Chao | Securing access to a service data object |
| US20070294528A1 (en)* | 2004-10-08 | 2007-12-20 | Mamoru Shoji | Authentication System |
| US20080010665A1 (en)* | 2006-07-07 | 2008-01-10 | Hinton Heather M | Method and system for policy-based initiation of federation management |
| US20080109895A1 (en)* | 2004-08-10 | 2008-05-08 | Koninklijke Philips Electronics, N.V. | Method and System for Multi-Authentication Logon Control |
| US20080134305A1 (en)* | 2005-12-16 | 2008-06-05 | Hinton Heather M | Method and system for extending authentication methods |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP3826764B2 (en)* | 2001-10-31 | 2006-09-27 | ソニー株式会社 | Data processing method, data processing apparatus, and program |
| US7562382B2 (en)* | 2004-12-16 | 2009-07-14 | International Business Machines Corporation | Specializing support for a federation relationship |
- 2006
- 2006-07-25USUS11/493,693patent/US8799639B2/enactiveActive
- 2007
- 2007-07-03AUAU2007203101Apatent/AU2007203101B8/enactiveActive
- 2007-07-06GBGB0713184.0Apatent/GB2440425B/enactiveActive
- 2007-07-17DEDE102007033615.4Apatent/DE102007033615B4/enactiveActive
- 2007-07-23CNCN2007101390245Apatent/CN101114237B/ennot_activeExpired - Fee Related
Patent Citations (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20010000358A1 (en) | 1998-06-12 | 2001-04-19 | Kousei Isomichi | Gateway system and recording medium |
| WO2001052025A2 (en) | 2000-01-10 | 2001-07-19 | Sun Microsystems, Inc. | Accessing multiple services with a unique user name |
| WO2001052025A3 (en) | 2000-01-10 | 2002-05-02 | Sun Microsystems Inc | Accessing multiple services with a unique user name |
| WO2002039237A3 (en) | 2000-11-09 | 2003-10-09 | Ibm | Method and system for web-based cross-domain single-sign-on authentication |
| WO2002039237A2 (en) | 2000-11-09 | 2002-05-16 | International Business Machines Corporation | Method and system for web-based cross-domain single-sign-on authentication |
| US20020156905A1 (en) | 2001-02-21 | 2002-10-24 | Boris Weissman | System for logging on to servers through a portal computer |
| US20030177388A1 (en)* | 2002-03-15 | 2003-09-18 | International Business Machines Corporation | Authenticated identity translation within a multiple computing unit environment |
| US20060179312A1 (en)* | 2003-12-23 | 2006-08-10 | Wachovia Corporation | Authentication system for networked computer applications |
| US20080109895A1 (en)* | 2004-08-10 | 2008-05-08 | Koninklijke Philips Electronics, N.V. | Method and System for Multi-Authentication Logon Control |
| US20060041933A1 (en) | 2004-08-23 | 2006-02-23 | International Business Machines Corporation | Single sign-on (SSO) for non-SSO-compliant applications |
| US20070294528A1 (en)* | 2004-10-08 | 2007-12-20 | Mamoru Shoji | Authentication System |
| US20080134305A1 (en)* | 2005-12-16 | 2008-06-05 | Hinton Heather M | Method and system for extending authentication methods |
| US20070255958A1 (en)* | 2006-05-01 | 2007-11-01 | Microsoft Corporation | Claim transformations for trust relationships |
| US20070271618A1 (en)* | 2006-05-19 | 2007-11-22 | Ching-Yun Chao | Securing access to a service data object |
| US20080010665A1 (en)* | 2006-07-07 | 2008-01-10 | Hinton Heather M | Method and system for policy-based initiation of federation management |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120167186A1 (en)* | 2009-07-14 | 2012-06-28 | Bundesdruckerei Gmbh | Method for producing a soft token |
| US9240992B2 (en)* | 2009-07-14 | 2016-01-19 | Bundesdruckerei Gmbh | Method for producing a soft token |
| US20130318569A1 (en)* | 2012-05-22 | 2013-11-28 | International Business Machines Corporation | Propagating Delegated Authorized Credentials Through Legacy Systems |
| US9172694B2 (en)* | 2012-05-22 | 2015-10-27 | International Business Machines Corporation | Propagating delegated authorized credentials through legacy systems |
| US20220337576A1 (en)* | 2021-04-15 | 2022-10-20 | Jpmorgan Chase Bank, N.A. | System and method for smart authentication |
| US11632365B2 (en)* | 2021-04-15 | 2023-04-18 | Jpmorgan Chase Bank, N.A. | System and method for smart authentication |
Also Published As
| Publication number | Publication date |
|---|---|
| AU2007203101B2 (en) | 2012-10-11 |
| GB0713184D0 (en) | 2007-08-15 |
| US20080046715A1 (en) | 2008-02-21 |
| AU2007203101B8 (en) | 2013-02-07 |
| DE102007033615A1 (en) | 2008-01-31 |
| CN101114237B (en) | 2010-10-13 |
| AU2007203101A1 (en) | 2008-02-14 |
| GB2440425B (en) | 2012-01-11 |
| DE102007033615B4 (en) | 2023-01-19 |
| CN101114237A (en) | 2008-01-30 |
| GB2440425A (en) | 2008-01-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US8799639B2 (en) | Method and apparatus for converting authentication-tokens to facilitate interactions between applications | |
| JP7457173B2 (en) | Internet of Things (IOT) device management | |
| US10581827B2 (en) | Using application level authentication for network login | |
| US11082225B2 (en) | Information processing system and control method therefor | |
| CN109428947B (en) | Authority transfer system, control method thereof and storage medium | |
| US6934848B1 (en) | Technique for handling subsequent user identification and password requests within a certificate-based host session | |
| US6976164B1 (en) | Technique for handling subsequent user identification and password requests with identity change within a certificate-based host session | |
| CN106209749B (en) | Single sign-on method and device, and related equipment and application processing method and device | |
| US9917829B1 (en) | Method and apparatus for providing a conditional single sign on | |
| KR101302763B1 (en) | Method and apparatus for providing trusted single sign-on access to applications and internet-based services | |
| JP5009294B2 (en) | Distributed single sign-on service | |
| US7150038B1 (en) | Facilitating single sign-on by using authenticated code to access a password store | |
| US9166975B2 (en) | System and method for secure remote access to a service on a server computer | |
| CN104580184B (en) | Identity identifying method between mutual trust application system | |
| US20100100950A1 (en) | Context-based adaptive authentication for data and services access in a network | |
| US11277404B2 (en) | System and data processing method | |
| US20180205745A1 (en) | System, method and computer program product for access authentication | |
| TW200833060A (en) | Authentication delegation based on re-verification of cryptographic evidence | |
| US10257171B2 (en) | Server public key pinning by URL | |
| US9590972B2 (en) | Application authentication using network authentication information | |
| US7540020B1 (en) | Method and apparatus for facilitating single sign-on to applications | |
| CN111147525A (en) | Authentication method, system, server and storage medium based on API gateway | |
| CN114338078B (en) | A CS client login method and device | |
| CN114584381A (en) | Security authentication method and device based on gateway, electronic equipment and storage medium | |
| KR102741305B1 (en) | System and method for controlling file encryption and decryption permissions in shared folders |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| AS | Assignment | Owner name:INTUIT, INC., CALIFORNIA Free format text:ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BALAZS, ALEX G.;PAN, ZANE Z. Y.;REEL/FRAME:018137/0403;SIGNING DATES FROM 20060713 TO 20060718 Owner name:INTUIT, INC., CALIFORNIA Free format text:ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BALAZS, ALEX G.;PAN, ZANE Z. Y.;SIGNING DATES FROM 20060713 TO 20060718;REEL/FRAME:018137/0403 | |
| FEPP | Fee payment procedure | Free format text:PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY | |
| STCF | Information on status: patent grant | Free format text:PATENTED CASE | |
| MAFP | Maintenance fee payment | Free format text:PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551) Year of fee payment:4 | |
| MAFP | Maintenance fee payment | Free format text:PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment:8 |